Home-setup - HW-specs?

[ejgh-oe]

Hi,
I intend to run SO (2.4) at home and thought about using an old Dell 7010 PC with the following specs:
Intel Core i7 (8 cores), 16GB RAM, 256GB SSD, 1 GE NIC builtin, 1 USB network connection.

Is this hardware setup capable of running SO given a 40MBit/s internet connection?

If yes, should I go for the "eval" or "standalone" setup?

Thanks much in advance for your help.

[attinaibhayo]

Please see https://docs.securityonion.net/en/2.4/hardware.html

[InfosecGoon]

That should be adequate for a standalone installation, although with only 256GB of storage you may want to disable or tune down the full packet capture capabilities.

Documentation for that:

https://docs.securityonion.net/en/2.4/stenographer.html#disabling
https://docs.securityonion.net/en/2.4/bpf.html

[ejgh-oe]

Hi,
In the meantime I tried both types: standalone and eval.

Unfortunately standalone didn't work (got an error during installation) but installing in eval mode worked. However even in an eval installation 16GB RAM seems barely enough: "top" shows almost all memory actively used with only around 200MB free RAM, almost nothing for buffer memory; with not even anything coming in from the capture interface at all (interface disconnected). So in order to really use SO I've got to look for a machine with more RAM.

Thanks much for the hint wrt. tuning packet capture - seems like I'll be in for some BPF filters in the near future ;-)